1 84c190b6 2021-12-17 jrmu #!/usr/bin/perl
3 84c190b6 2021-12-17 jrmu package Shell;
6 84c190b6 2021-12-17 jrmu use warnings;
7 84c190b6 2021-12-17 jrmu use OpenBSD::Pledge;
8 84c190b6 2021-12-17 jrmu use OpenBSD::Unveil;
9 84c190b6 2021-12-17 jrmu use MIME::Base64;
10 84c190b6 2021-12-17 jrmu use Data::Dumper;
11 84c190b6 2021-12-17 jrmu use Digest::SHA qw(sha256_hex);
12 84c190b6 2021-12-17 jrmu use lib './';
13 84c190b6 2021-12-17 jrmu require "SQLite.pm";
14 84c190b6 2021-12-17 jrmu require "Hash.pm";
16 84c190b6 2021-12-17 jrmu my %conf = %main::conf;
17 84c190b6 2021-12-17 jrmu my $chans = $conf{chans};
18 84c190b6 2021-12-17 jrmu my $teamchans = $conf{teamchans};
19 84c190b6 2021-12-17 jrmu my @teamchans = split /[,\s]+/m, $teamchans;
20 84c190b6 2021-12-17 jrmu my $staff = $conf{staff};
21 84c190b6 2021-12-17 jrmu my $captchaURL = "https://example.com/captcha.php?vhost=";
22 84c190b6 2021-12-17 jrmu my $hostname = $conf{hostname};
23 84c190b6 2021-12-17 jrmu my $terms = $conf{terms};
24 84c190b6 2021-12-17 jrmu my $expires = $conf{expires};
25 84c190b6 2021-12-17 jrmu my $mailfrom = $conf{mailfrom};
26 84c190b6 2021-12-17 jrmu my $mailname = $conf{mailname};
27 717afa50 2023-03-05 jrmu my $approval = $conf{approval};
28 0b43d183 2023-06-30 jrmu my $loginclass = $conf{loginclass} || "freeshell";
29 84c190b6 2021-12-17 jrmu my $passpath = "/etc/passwd";
30 84c190b6 2021-12-17 jrmu my $httpdconfpath = "/etc/httpd.conf";
31 84c190b6 2021-12-17 jrmu my $acmeconfpath = "/etc/acme-client.conf";
32 84c190b6 2021-12-17 jrmu my $pfconfpath = "/etc/pf.conf";
33 84c190b6 2021-12-17 jrmu my $relaydconfpath = "/etc/relayd.conf";
34 84c190b6 2021-12-17 jrmu my $startPort;
35 84c190b6 2021-12-17 jrmu my $endPort;
37 6e075d98 2023-03-12 jrmu use constant {
39 6e075d98 2023-03-12 jrmu ERRORS => 1,
40 6e075d98 2023-03-12 jrmu WARNINGS => 2,
44 84c190b6 2021-12-17 jrmu main::cbind("pub", "-", "shell", \&mshell);
45 84c190b6 2021-12-17 jrmu main::cbind("msg", "-", "shell", \&mshell);
48 84c190b6 2021-12-17 jrmu #dependencies for figlet
49 84c190b6 2021-12-17 jrmu unveil("/usr/local/bin/figlet", "rx") or die "Unable to unveil $!";
50 84c190b6 2021-12-17 jrmu unveil("/usr/lib/libc.so.95.1", "r") or die "Unable to unveil $!";
51 84c190b6 2021-12-17 jrmu unveil("/usr/libexec/ld.so", "r") or die "Unable to unveil $!";
52 84c190b6 2021-12-17 jrmu #dependencies for shell account
53 84c190b6 2021-12-17 jrmu unveil($passpath, "r") or die "Unable to unveil $!";
54 84c190b6 2021-12-17 jrmu unveil($httpdconfpath, "rwxc") or die "Unable to unveil $!";
55 84c190b6 2021-12-17 jrmu unveil($acmeconfpath, "rwxc") or die "Unable to unveil $!";
56 84c190b6 2021-12-17 jrmu unveil($pfconfpath, "rwxc") or die "Unable to unveil $!";
57 84c190b6 2021-12-17 jrmu unveil($relaydconfpath, "rwxc") or die "Unable to unveil $!";
58 84c190b6 2021-12-17 jrmu unveil("/usr/sbin/chown", "rx") or die "Unable to unveil $!";
59 84c190b6 2021-12-17 jrmu unveil("/bin/chmod", "rx") or die "Unable to unveil $!";
60 84c190b6 2021-12-17 jrmu unveil("/usr/sbin/groupadd", "rx") or die "Unable to unveil $!";
61 84c190b6 2021-12-17 jrmu unveil("/usr/sbin/useradd", "rx") or die "Unable to unveil $!";
62 717afa50 2023-03-05 jrmu unveil("/usr/sbin/usermod", "rx") or die "Unable to unveil $!";
63 84c190b6 2021-12-17 jrmu unveil("/usr/sbin/groupdel", "rx") or die "Unable to unveil $!";
64 84c190b6 2021-12-17 jrmu unveil("/usr/sbin/userdel", "rx") or die "Unable to unveil $!";
65 84c190b6 2021-12-17 jrmu unveil("/bin/mkdir", "rx") or die "Unable to unveil $!";
66 84c190b6 2021-12-17 jrmu unveil("/bin/ln", "rx") or die "Unable to unveil $!";
67 84c190b6 2021-12-17 jrmu unveil("/usr/sbin/acme-client", "rx") or die "Unable to unveil $!";
68 84c190b6 2021-12-17 jrmu unveil("/bin/rm", "rx") or die "Unable to unveil $!";
69 84c190b6 2021-12-17 jrmu unveil("/bin/mv", "rx") or die "Unable to unveil $!";
70 84c190b6 2021-12-17 jrmu unveil("/home/", "rwxc") or die "Unable to unveil $!";
73 84c190b6 2021-12-17 jrmu # !shell <username> <email>
74 84c190b6 2021-12-17 jrmu # !shell captcha <captcha>
75 84c190b6 2021-12-17 jrmu sub mshell {
76 84c190b6 2021-12-17 jrmu my ($bot, $nick, $host, $hand, @args) = @_;
77 84c190b6 2021-12-17 jrmu my ($chan, $text);
78 84c190b6 2021-12-17 jrmu if (@args == 2) {
79 84c190b6 2021-12-17 jrmu ($chan, $text) = ($args[0], $args[1]);
80 84c190b6 2021-12-17 jrmu } else { $text = $args[0]; }
81 84c190b6 2021-12-17 jrmu my $hostmask = "$nick!$host";
82 84c190b6 2021-12-17 jrmu if (defined($chan) && $chans =~ /$chan/) {
83 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $chan :$nick: Please check private message");
85 84c190b6 2021-12-17 jrmu if ($text =~ /^$/) {
86 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $nick :Type !help for new instructions");
87 84c190b6 2021-12-17 jrmu foreach my $chan (@teamchans) {
88 12a821c6 2023-03-06 jrmu main::putservlocalnet($bot, "PRIVMSG $chan :$staff: Help *$nick* on network ".$bot->{name}." with shell registration");
91 84c190b6 2021-12-17 jrmu } elsif (main::isstaff($bot, $nick) && $text =~ /^delete\s+([[:ascii:]]+)/) {
92 84c190b6 2021-12-17 jrmu my $username = $1;
93 84c190b6 2021-12-17 jrmu if (SQLite::deleterows("shell", "username", $username)) {
94 84c190b6 2021-12-17 jrmu # TODO delete shell
95 84c190b6 2021-12-17 jrmu deleteshell($username);
96 84c190b6 2021-12-17 jrmu foreach my $chan (@teamchans) {
97 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $chan :$username deleted");
101 ccc446d9 2023-03-05 jrmu } elsif (main::isstaff($bot, $nick) && $text =~ /^approve\s+([[:ascii:]]+)/) {
102 717afa50 2023-03-05 jrmu my $username = $1;
103 0744bd0b 2023-05-06 jrmu system "doas usermod -U $username";
104 717afa50 2023-03-05 jrmu foreach my $chan (@teamchans) {
105 ccc446d9 2023-03-05 jrmu main::putserv($bot, "PRIVMSG $chan :$username approved");
109 84c190b6 2021-12-17 jrmu ### TODO: Check duplicate emails ###
110 84c190b6 2021-12-17 jrmu my @rows = SQLite::selectrows("irc", "nick", $nick);
111 84c190b6 2021-12-17 jrmu foreach my $row (@rows) {
112 84c190b6 2021-12-17 jrmu my $password = SQLite::get("shell", "ircid", $row->{id}, "password");
113 84c190b6 2021-12-17 jrmu if (defined($password)) {
114 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $nick :Sorry, only one account per person. Please contact staff if you need help.");
118 84c190b6 2021-12-17 jrmu if ($text =~ /^lastseen\s+([[:alnum:]]+)/) {
120 84c190b6 2021-12-17 jrmu if ($text =~ /^captcha\s+([[:alnum:]]+)/) {
121 84c190b6 2021-12-17 jrmu my $text = $1;
122 84c190b6 2021-12-17 jrmu my $ircid = SQLite::id("irc", "nick", $nick, $expires);
123 84c190b6 2021-12-17 jrmu if (!defined($ircid)) { die "undefined ircid"; }
124 84c190b6 2021-12-17 jrmu my $captcha = SQLite::get("shell", "ircid", $ircid, "captcha");
125 84c190b6 2021-12-17 jrmu if ($text ne $captcha) {
126 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $nick :Wrong captcha. To get a new captcha, type !shell <username> <email>");
129 84c190b6 2021-12-17 jrmu my $pass = Hash::newpass();
130 84c190b6 2021-12-17 jrmu chomp(my $encrypted = `encrypt $pass`);
131 84c190b6 2021-12-17 jrmu my $username = SQLite::get("shell", "ircid", $ircid, "username");
132 84c190b6 2021-12-17 jrmu my $email = SQLite::get("shell", "ircid", $ircid, "email");
133 84c190b6 2021-12-17 jrmu my $version = SQLite::get("shell", "ircid", $ircid, "version");
134 84c190b6 2021-12-17 jrmu my $bindhost = "$username.$hostname";
135 84c190b6 2021-12-17 jrmu SQLite::set("shell", "ircid", $ircid, "password", $encrypted);
136 84c190b6 2021-12-17 jrmu if (DNS::nextdns($username)) {
138 84c190b6 2021-12-17 jrmu createshell($username, $pass, $bindhost);
139 84c190b6 2021-12-17 jrmu mailshell($username, $email, $pass, "shell", $version);
140 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $nick :Check your email!");
141 717afa50 2023-03-05 jrmu if ($approval eq "true") {
142 0744bd0b 2023-05-06 jrmu system "doas usermod -Z $username";
143 717afa50 2023-03-05 jrmu main::putserv($bot, "PRIVMSG $nick :Your account has been created but must be manually approved by your admins ($staff) before it can be used.");
144 717afa50 2023-03-05 jrmu foreach my $chan (@teamchans) {
145 717afa50 2023-03-05 jrmu main::putservlocalnet($bot, "PRIVMSG $chan :$staff: $nick\'s account $username must be manually unblocked before it can be used.");
148 717afa50 2023-03-05 jrmu foreach my $chan (@teamchans) {
149 8f114ba7 2023-03-06 jrmu main::putservlocalnet($bot, "PRIVMSG $chan :$staff: $nick\'s shell registration of $username on $bot->{name} was successful, *but* you *must* help him connect. Most users are unable to connect. Show him https://wiki.ircnow.org/?n=Shell.Shell");
153 84c190b6 2021-12-17 jrmu #www($newnick, $reply, $password, "bouncer");
155 84c190b6 2021-12-17 jrmu foreach my $chan (@teamchans) {
156 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $chan :Assigning bindhost $bindhost failed");
160 84c190b6 2021-12-17 jrmu } elsif ($text =~ /^([[:alnum:]]+)\s+([[:ascii:]]+)/) {
161 84c190b6 2021-12-17 jrmu my ($username, $email) = ($1, $2);
162 84c190b6 2021-12-17 jrmu my @users = col($passpath, 1, ":");
163 84c190b6 2021-12-17 jrmu my @matches = grep(/^$username$/i, @users);
164 84c190b6 2021-12-17 jrmu if (scalar(@matches) > 0) {
165 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $nick :Sorry, username taken. Please choose another username, or contact staff for help.");
168 84c190b6 2021-12-17 jrmu # my $captcha = join'', map +(0..9,'a'..'z','A'..'Z')[rand(10+26*2)], 1..4;
169 84c190b6 2021-12-17 jrmu my $captcha = int(rand(999));
170 84c190b6 2021-12-17 jrmu my $ircid = int(rand(2147483647));
171 84c190b6 2021-12-17 jrmu SQLite::set("irc", "id", $ircid, "localtime", time());
172 84c190b6 2021-12-17 jrmu SQLite::set("irc", "id", $ircid, "date", main::date());
173 84c190b6 2021-12-17 jrmu SQLite::set("irc", "id", $ircid, "hostmask", $hostmask);
174 84c190b6 2021-12-17 jrmu SQLite::set("irc", "id", $ircid, "nick", $nick);
175 84c190b6 2021-12-17 jrmu SQLite::set("shell", "ircid", $ircid, "username", $username);
176 84c190b6 2021-12-17 jrmu SQLite::set("shell", "ircid", $ircid, "email", $email);
177 84c190b6 2021-12-17 jrmu SQLite::set("shell", "ircid", $ircid, "captcha", $captcha);
178 84c190b6 2021-12-17 jrmu main::whois($bot->{sock}, $nick);
179 84c190b6 2021-12-17 jrmu main::ctcp($bot->{sock}, $nick);
180 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $nick :".`figlet $captcha`);
181 8de79cd0 2023-03-06 jrmu # main::putserv($bot, "PRIVMSG $nick :$captchaURL".encode_base64($captcha));
182 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $nick :Type !shell captcha <text>");
183 84c190b6 2021-12-17 jrmu foreach my $chan (@teamchans) {
184 84c190b6 2021-12-17 jrmu main::putservlocalnet($bot, "PRIVMSG $chan :$nick\'s captcha on $bot->{name} is $captcha");
187 84c190b6 2021-12-17 jrmu main::putserv($bot, "PRIVMSG $nick :Invalid username or email. Type !shell <username> <email> to try again.");
188 84c190b6 2021-12-17 jrmu foreach my $chan (@teamchans) {
189 12a821c6 2023-03-06 jrmu main::putserv($bot, "PRIVMSG $chan :$staff: Help *$nick* on network ".$bot->{name}." with shell registration");
193 84c190b6 2021-12-17 jrmu sub mailshell {
194 84c190b6 2021-12-17 jrmu my( $username, $email, $password, $service, $version )=@_;
195 84c190b6 2021-12-17 jrmu my $passhash = sha256_hex("$username");
196 84c190b6 2021-12-17 jrmu my $versionhash = encode_base64($version);
197 c54830ad 2023-03-05 jrmu my $approvemsg;
198 c54830ad 2023-03-05 jrmu if ($approval eq "true") {
199 c54830ad 2023-03-05 jrmu $approvemsg = <<"EOF";
201 c54830ad 2023-03-05 jrmu *IMPORTANT*: Your account has been created but it has not yet been
202 8de79cd0 2023-03-06 jrmu approved. To get your account approved, please contact your admins
203 c54830ad 2023-03-05 jrmu $staff on IRC and by email.
208 84c190b6 2021-12-17 jrmu my $body = <<"EOF";
209 84c190b6 2021-12-17 jrmu You created a shell account!
211 84c190b6 2021-12-17 jrmu Username: $username
212 84c190b6 2021-12-17 jrmu Password: $password
213 84c190b6 2021-12-17 jrmu Server: $hostname
214 84c190b6 2021-12-17 jrmu SSH Port: 22
215 84c190b6 2021-12-17 jrmu Your Ports: $startPort to $endPort
217 c54830ad 2023-03-05 jrmu To customize your vhost, connect to ask in $chans
218 c54830ad 2023-03-05 jrmu $approvemsg
219 84c190b6 2021-12-17 jrmu *IMPORTANT*: Verify your email address:
221 cc35978b 2023-03-01 jrmu Please reply to this email to indicate you have received the email. You must
222 cc35978b 2023-03-01 jrmu reply in order to keep your account.
226 4a735b99 2023-03-07 jrmu main::mail($mailfrom, $email, $mailname, "Verify IRCNow Account", $body);
230 84c190b6 2021-12-17 jrmu #sub mregex {
231 84c190b6 2021-12-17 jrmu # my ($bot, $nick, $host, $hand, $text) = @_;
232 84c190b6 2021-12-17 jrmu # if ($staff !~ /$nick/) { return; }
233 84c190b6 2021-12-17 jrmu # if ($text =~ /^ips?\s+([-_()|0-9A-Za-z:\.?*\s]{3,})$/) {
234 84c190b6 2021-12-17 jrmu # my $ips = $1; # space-separated list of IPs
235 84c190b6 2021-12-17 jrmu # main::putserv($bot, "PRIVMSG $nick :".regexlist($ips));
236 84c190b6 2021-12-17 jrmu # } elsif ($text =~ /^users?\s+([-_()|0-9A-Za-z:\.?*\s]{3,})$/) {
237 84c190b6 2021-12-17 jrmu # my $users = $1; # space-separated list of usernames
238 84c190b6 2021-12-17 jrmu # main::putserv($bot, "PRIVMSG $nick :".regexlist($users));
239 84c190b6 2021-12-17 jrmu # } elsif ($text =~ /^[-_()|0-9A-Za-z:,\.?*\s]{3,}$/) {
240 84c190b6 2021-12-17 jrmu # my @lines = regex($text);
241 84c190b6 2021-12-17 jrmu # foreach my $l (@lines) { print "$l\n"; }
244 84c190b6 2021-12-17 jrmu #sub mforeach {
245 84c190b6 2021-12-17 jrmu # my ($bot, $nick, $host, $hand, $text) = @_;
246 84c190b6 2021-12-17 jrmu # if ($staff !~ /$nick/) { return; }
247 84c190b6 2021-12-17 jrmu # if ($text =~ /^network\s+del\s+([[:graph:]]+)\s+(#[[:graph:]]+)$/) {
248 84c190b6 2021-12-17 jrmu # my ($user, $chan) = ($1, $2);
249 84c190b6 2021-12-17 jrmu # foreach my $n (@main::networks) {
250 84c190b6 2021-12-17 jrmu # main::putserv($bot, "PRIVMSG *controlpanel :delchan $user $n->{name} $chan");
255 84c190b6 2021-12-17 jrmu #sub loadlog {
256 84c190b6 2021-12-17 jrmu # open(my $fh, '<', "$authlog") or die "Could not read file 'authlog' $!";
257 84c190b6 2021-12-17 jrmu # chomp(@logs = <$fh>);
258 84c190b6 2021-12-17 jrmu # close $fh;
261 84c190b6 2021-12-17 jrmu # return all lines matching a pattern
262 84c190b6 2021-12-17 jrmu #sub regex {
263 84c190b6 2021-12-17 jrmu # my ($pattern) = @_;
264 84c190b6 2021-12-17 jrmu # if (!@logs) { loadlog(); }
265 84c190b6 2021-12-17 jrmu # return grep(/$pattern/, @logs);
268 84c190b6 2021-12-17 jrmu # given a list of IPs, return matching users
269 84c190b6 2021-12-17 jrmu # or given a list of users, return matching IPs
270 84c190b6 2021-12-17 jrmu #sub regexlist {
271 84c190b6 2021-12-17 jrmu # my ($items) = @_;
272 84c190b6 2021-12-17 jrmu # my @items = split /[,\s]+/m, $items;
273 84c190b6 2021-12-17 jrmu # my $pattern = "(".join('|', @items).")";
274 84c190b6 2021-12-17 jrmu # if (!@logs) { loadlog(); }
275 84c190b6 2021-12-17 jrmu # my @matches = grep(/$pattern/, @logs);
276 84c190b6 2021-12-17 jrmu # my @results;
277 84c190b6 2021-12-17 jrmu # foreach my $match (@matches) {
278 84c190b6 2021-12-17 jrmu # if ($match =~ /^\[\d{4}-\d\d-\d\d \d\d:\d\d:\d\d\] \[([^]\/]+)(\/[^]]+)?\] connected to ZNC from (.*)/) {
279 84c190b6 2021-12-17 jrmu # my ($user, $ip) = ($1, $3);
280 84c190b6 2021-12-17 jrmu # if ($items =~ /[.:]/) { # items are IP addresses
281 84c190b6 2021-12-17 jrmu # push(@results, $user);
282 84c190b6 2021-12-17 jrmu # } else { # items are users
283 84c190b6 2021-12-17 jrmu # push(@results, $ip);
287 84c190b6 2021-12-17 jrmu # my @sorted = sort @results;
288 84c190b6 2021-12-17 jrmu # @results = do { my %seen; grep { !$seen{$_}++ } @sorted }; # uniq
289 84c190b6 2021-12-17 jrmu # return join(' ', @results);
292 84c190b6 2021-12-17 jrmu sub createshell {
293 84c190b6 2021-12-17 jrmu my ($username, $password, $bindhost) = @_;
294 84c190b6 2021-12-17 jrmu system "doas groupadd $username";
295 84c190b6 2021-12-17 jrmu system "doas adduser -batch $username $username $username `encrypt $password`";
296 84c190b6 2021-12-17 jrmu system "doas chmod 700 /home/$username /home/$username/.ssh";
297 84c190b6 2021-12-17 jrmu system "doas chmod 600 /home/$username/{.Xdefaults,.cshrc,.cvsrc,.login,.mailrc,.profile}";
298 84c190b6 2021-12-17 jrmu system "doas mkdir /var/www/htdocs/$username";
299 84c190b6 2021-12-17 jrmu system "doas ln -s /var/www/htdocs/$username /home/$username/htdocs";
300 84c190b6 2021-12-17 jrmu system "doas chown -R $username:www /var/www/htdocs/$username /home/$username/htdocs";
301 84c190b6 2021-12-17 jrmu system "doas chmod -R o-rx /var/www/htdocs/$username /home/$username/htdocs";
302 84c190b6 2021-12-17 jrmu system "doas chmod -R g+rwx /var/www/htdocs/$username /home/$username/htdocs";
303 9660b701 2023-03-05 jrmu system "doas chown root:wheel $httpdconfpath $pfconfpath $acmeconfpath $relaydconfpath";
304 9660b701 2023-03-05 jrmu system "doas chmod g+rw $httpdconfpath $pfconfpath $acmeconfpath $relaydconfpath";
305 84c190b6 2021-12-17 jrmu my $lusername = lc $username;
306 84c190b6 2021-12-17 jrmu my $block = <<"EOF";
307 84c190b6 2021-12-17 jrmu server "$lusername.$hostname" {
308 84c190b6 2021-12-17 jrmu listen on * port 80
309 84c190b6 2021-12-17 jrmu location "/.well-known/acme-challenge/*" {
310 84c190b6 2021-12-17 jrmu root "/acme"
311 84c190b6 2021-12-17 jrmu request strip 2
313 84c190b6 2021-12-17 jrmu location "*.php" {
314 84c190b6 2021-12-17 jrmu fastcgi socket "/run/php-fpm.sock"
316 84c190b6 2021-12-17 jrmu root "/htdocs/$username"
319 84c190b6 2021-12-17 jrmu main::appendfile($httpdconfpath, $block);
320 84c190b6 2021-12-17 jrmu $block = <<"EOF";
321 84c190b6 2021-12-17 jrmu domain "$lusername.$hostname" {
322 84c190b6 2021-12-17 jrmu domain key "/etc/ssl/private/$lusername.$hostname.key"
323 84c190b6 2021-12-17 jrmu domain full chain certificate "/etc/ssl/$lusername.$hostname.crt"
324 84c190b6 2021-12-17 jrmu sign with letsencrypt
327 84c190b6 2021-12-17 jrmu main::appendfile($acmeconfpath, $block);
328 84c190b6 2021-12-17 jrmu configurepf($username);
329 84c190b6 2021-12-17 jrmu system "doas rcctl reload httpd";
330 84c190b6 2021-12-17 jrmu system "doas acme-client -F $lusername.$hostname";
331 84c190b6 2021-12-17 jrmu system "doas ln -s /etc/ssl/$lusername.$hostname.crt /etc/ssl/$lusername.$hostname.fullchain.pem";
332 84c190b6 2021-12-17 jrmu system "doas pfctl -f /etc/pf.conf";
333 84c190b6 2021-12-17 jrmu configurerelayd($username);
334 84c190b6 2021-12-17 jrmu $block = <<"EOF";
335 84c190b6 2021-12-17 jrmu ~ * * * * acme-client $lusername.$hostname && rcctl reload relayd
337 84c190b6 2021-12-17 jrmu system "echo $block | doas crontab -";
338 0b43d183 2023-06-30 jrmu system "doas usermod -L $loginclass $username";
339 84c190b6 2021-12-17 jrmu #edquota $username
343 84c190b6 2021-12-17 jrmu sub deleteshell {
344 84c190b6 2021-12-17 jrmu my ($username, $bindhost) = @_;
345 84c190b6 2021-12-17 jrmu my $lusername = lc $username;
346 9660b701 2023-03-05 jrmu system "doas chown root:wheel $httpdconfpath $pfconfpath $acmeconfpath $relaydconfpath";
347 9660b701 2023-03-05 jrmu system "doas chmod g+rw $httpdconfpath $pfconfpath $acmeconfpath $relaydconfpath";
348 84c190b6 2021-12-17 jrmu system "doas groupdel $username";
349 84c190b6 2021-12-17 jrmu system "doas userdel $username";
350 84c190b6 2021-12-17 jrmu system "doas rm -f /etc/ssl/$lusername.$hostname.crt /etc/ssl/$lusername.$hostname.fullchain.pem /etc/ssl/private/$lusername.$hostname.key";
351 84c190b6 2021-12-17 jrmu my $httpdconf = main::readstr($httpdconfpath);
352 84c190b6 2021-12-17 jrmu my $block = <<"EOF";
353 84c190b6 2021-12-17 jrmu server "$lusername.$hostname" {
354 84c190b6 2021-12-17 jrmu listen on * port 80
355 84c190b6 2021-12-17 jrmu location "/.well-known/acme-challenge/*" {
356 84c190b6 2021-12-17 jrmu root "/acme"
357 84c190b6 2021-12-17 jrmu request strip 2
359 84c190b6 2021-12-17 jrmu location "*.php" {
360 84c190b6 2021-12-17 jrmu fastcgi socket "/run/php-fpm.sock"
362 84c190b6 2021-12-17 jrmu root "/htdocs/$username"
365 84c190b6 2021-12-17 jrmu $block =~ s/{/\\{/gm;
366 84c190b6 2021-12-17 jrmu $block =~ s/}/\\}/gm;
367 84c190b6 2021-12-17 jrmu $block =~ s/\./\\./gm;
368 84c190b6 2021-12-17 jrmu $block =~ s/\*/\\*/gm;
369 84c190b6 2021-12-17 jrmu $httpdconf =~ s{$block}{}gm;
370 84c190b6 2021-12-17 jrmu print $httpdconf;
371 84c190b6 2021-12-17 jrmu main::writefile($httpdconfpath, $httpdconf);
373 84c190b6 2021-12-17 jrmu my $acmeconf = main::readstr($acmeconfpath);
374 84c190b6 2021-12-17 jrmu $block = <<"EOF";
375 84c190b6 2021-12-17 jrmu domain "$lusername.$hostname" {
376 84c190b6 2021-12-17 jrmu domain key "/etc/ssl/private/$lusername.$hostname.key"
377 84c190b6 2021-12-17 jrmu domain full chain certificate "/etc/ssl/$lusername.$hostname.fullchain.pem"
378 84c190b6 2021-12-17 jrmu sign with letsencrypt
381 84c190b6 2021-12-17 jrmu $block =~ s/{/\\{/gm;
382 84c190b6 2021-12-17 jrmu $block =~ s/}/\\}/gm;
383 84c190b6 2021-12-17 jrmu $block =~ s/\./\\./gm;
384 84c190b6 2021-12-17 jrmu $block =~ s/\*/\\*/gm;
385 84c190b6 2021-12-17 jrmu $acmeconf =~ s{$block}{}gm;
386 84c190b6 2021-12-17 jrmu main::writefile($acmeconfpath, $acmeconf);
390 84c190b6 2021-12-17 jrmu #TODO Fix for $i
391 84c190b6 2021-12-17 jrmu # Return column $i from $filename as an array with file separator $FS
393 84c190b6 2021-12-17 jrmu my ($filename, $i, $FS) = @_;
394 84c190b6 2021-12-17 jrmu my @rows = main::readarray($filename);
395 84c190b6 2021-12-17 jrmu my @results;
396 84c190b6 2021-12-17 jrmu foreach my $row (@rows) {
397 84c190b6 2021-12-17 jrmu if ($row =~ /^(.*?)$FS/) {
398 84c190b6 2021-12-17 jrmu push(@results, $1);
401 84c190b6 2021-12-17 jrmu return @results;
404 84c190b6 2021-12-17 jrmu sub configurepf {
405 84c190b6 2021-12-17 jrmu my $username = shift;
406 84c190b6 2021-12-17 jrmu my @read = split('\n', main::readstr($pfconfpath) );
408 84c190b6 2021-12-17 jrmu my $previousline = "";
409 84c190b6 2021-12-17 jrmu my @pfcontent;
410 84c190b6 2021-12-17 jrmu foreach my $line(@read)
412 84c190b6 2021-12-17 jrmu my $currline = $line;
413 84c190b6 2021-12-17 jrmu if( $currline ne "# end user ports") {
414 84c190b6 2021-12-17 jrmu $previousline = $currline;
416 84c190b6 2021-12-17 jrmu #pass in proto {tcp udp} to port {31361:31370} user {JL}
417 84c190b6 2021-12-17 jrmu if( $previousline =~ /(\d*):(\d*)/ ) {
418 84c190b6 2021-12-17 jrmu my $startport = ( $1 + 10 );
419 84c190b6 2021-12-17 jrmu my $endport = ( $2 + 10 );
420 84c190b6 2021-12-17 jrmu my $insert = "pass in proto {tcp udp} to port {$startport:$endport} user {$username}";
421 84c190b6 2021-12-17 jrmu push(@pfcontent, $insert);
422 84c190b6 2021-12-17 jrmu $startPort = $startport;
423 84c190b6 2021-12-17 jrmu $endPort = $endport;
426 84c190b6 2021-12-17 jrmu push(@pfcontent, $currline)
428 84c190b6 2021-12-17 jrmu main::writefile("$pfconfpath", join("\n",@pfcontent))
431 84c190b6 2021-12-17 jrmu sub configurerelayd {
432 84c190b6 2021-12-17 jrmu my ($username) = @_;
433 84c190b6 2021-12-17 jrmu my $block = "tls { keypair $username.$hostname }";
434 84c190b6 2021-12-17 jrmu my $relaydconf = main::readstr($relaydconfpath);
435 84c190b6 2021-12-17 jrmu my $newconf;
436 84c190b6 2021-12-17 jrmu if ($relaydconf =~ /^.*tls\s+{\s+keypair\s+[.0-9a-zA-Z]+\s*}/m) {
437 84c190b6 2021-12-17 jrmu $newconf = "$`$&\n\t$block$'";
439 c8e91765 2023-03-12 jrmu $newconf = $relaydconf;
440 e5154b2e 2023-03-12 jrmu main::debug(ERRORS, "ERROR: regex can't match tls { keypair \$username.$hostname }");
442 84c190b6 2021-12-17 jrmu main::writefile($relaydconfpath, $newconf);
445 84c190b6 2021-12-17 jrmu #unveil("./newacct", "rx") or die "Unable to unveil $!";
446 84c190b6 2021-12-17 jrmu 1; # MUST BE LAST STATEMENT IN FILE
